Unable to use azure AD Pod Identity under trigger auth for Azure Servicebus queue scaler in keda v2.0

[sivakumar715]

I want to use trigger auth based on Azure AD pod identity to authenticate my azure service bus queue scaler, but it's not working. here is my scaler.yaml file.

apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: {{ .Release.Name | quote }}
spec:
  podIdentity:
    provider: azure
---
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: {{ .Release.Name | quote }}
  labels:
    {{- include "testfunctions.labels" . | nindent 4 }}
spec:
  scaleTargetRef:
    kind: Deployment
    name: {{ .Release.Name | quote }}
  pollingInterval: {{ .Values.autoScaling.pollInterval }}
  cooldownPeriod: {{ .Values.autoScaling.cooldownSeconds }}
  minReplicaCount: {{ .Values.autoScaling.minReplicaCount }}
  maxReplicaCount: {{ .Values.autoScaling.maxReplicaCount }}
  triggers:
  - type: azure-servicebus
    metadata:
      queueName: {{ .Values.serviceBus.serviceBusQueueName | quote }}
      namespace: {{ .Values.serviceBus.serviceBusNamespace | quote }}
      messageCount: {{ .Values.autoScaling.queueLength | quote }}
    authenticationRef:
        name: {{ .Release.Name | quote }}

please suggest us if anyone is aware of on , how to use azure servicebus queue scaler based on azure ad pod identity trigger auth.

[tomkerkhove]

That looks fine, but did you setup the identities correctly? Can you share the KEDA logs please?

This walkthrough should be helpful - https://github.com/kedacore/sample-dotnet-worker-servicebus-queue/blob/main/pod-identity.md

[sivakumar715]

thanks @tomkerkhove for looking.

Below is the identiy yaml file used in my code. here, "identity" refers the aks resource.

apiVersion: "aadpodidentity.k8s.io/v1"
kind: AzureIdentity
metadata:
  name: {{ .Values.identity.name | quote }}
  labels:
    {{- include "exaprocessor.labels" . | nindent 4 }}
spec:
  type: 0
  resourceID: {{ .Values.identity.resourceId | quote }}
  clientID: {{ .Values.identity.clientId | quote }}
---
apiVersion: "aadpodidentity.k8s.io/v1"
kind: AzureIdentityBinding
metadata:
  name: {{ .Values.identity.name | quote }}
  labels:
    {{- include "exaprocessor.labels" . | nindent 4 }}
spec:
  azureIdentity: {{ .Values.identity.name | quote }}
  selector: {{ .Values.identity.name | quote }}

I just gone the above link, please clarify below.

1. do i need to create identity for service bus resource and generate AzureIdentity & AzureIdentityBinding?
2. assign Azure Service Bus Data Receiver role to our servicebus autoscaler identity?

[tomkerkhove]

You don't need an identity for Service Bus, but the identity that you are using needs permissions on Azure Service Bus.

Can you please share the logs of KEDA?